Cybersecurity experts are warning that recently disclosed vulnerabilities could spark chaos across the internet.

The team behind PHP, a programming language used by popular website platforms including WordPress, released emergency security patches Wednesday to address two vulnerabilities that could allow hackers to take control of vulnerable web servers.

The PHP development team first warned of the vulnerabilities on Tuesday, rating both 9.2 out of 10 on the Common Vulnerability Scoring System.

“We are urging every organization and individual running PHP to prepare now so they can apply the update as soon as it is available,” the PHP Foundation said in a press release.

In a security advisory accompanying Wednesday’s patches, PHP developers confirmed that the vulnerabilities could allow hackers to remotely execute code on vulnerable servers without authorization.

The first flaw involves how PHP handles running out of memory, which can cause it to mistakenly process incomplete or corrupted information. The second flaw involves PHP mistakenly using outdated information from an earlier website request after the memory storing it has been released, potentially opening the door to malicious code execution. Together, the security flaws are being called “PHP2Shell.”

Security experts were sounding the alarm even before the patches were released. Security researcher Silas Cutler estimated that roughly 1.3 million internet hosts could be affected by the vulnerabilities.

“We expect mass attacks to start within 15 minutes of the release,” cybersecurity firm Sansec warned in a blog post , referring to the release of the emergency patches. The concern is that hackers could quickly analyze the updates to figure out how to exploit the vulnerabilities and launch automated attacks against websites that haven’t installed the fixes.

Source link